I'm trying to run Journalbeat on Kubernetes cluster and almost all works fine
I run pod with Privileges and access to /var/log/journal directory, so Journalbeat is reading it correctly, but....
But I want to also use Processor plugin "add_kubernetes_metadata" and journalbeat ends with error each time:
Exiting: error initializing publisher: error initializing processors: Can not initialize kubernetes plugin with zero matcher plugins
But here a config for K8s:
processors: - drop_event: when: not: has_fields: ['container.name'] - add_kubernetes_metadata: in_cluster: true - add_host_metadata: netinfo.enabled: false cache.ttl: 5m
Pod is run under kubernetes system namespace. I also tried to run it in "default" namespace, but always end with this error.
Any ideas? I'm doing something wrong ?